Secure data science intergrating cyber security and data science 1st Edition by Bhavani Thuraisngham, Murat Kantarcioglu, Latifur Khan ISBN 9781000557510 1000557510

Chapter 1 Introduction

1.1 Overview

1.2 Big Data Analytics, Data Science, and Machine Learning

1.3 Supporting Technologies

1.4 Data Science for Cyber Security

1.5 Security and Privacy Enhanced Data Science

1.6 Access Control and Data Science

1.7 Organization of This Book

1.8 Next Steps

Reference

PART I Supporting Technologies for Secure Data Science

Introduction to Part I

Chapter 2 Data Security and Privacy

2.1 Introduction

2.2 Security Policies

2.2.1 Access Control Policies

2.2.1.1 Authorization-based Access Control Policies

2.2.1.1.1 Positive authorization

2.2.1.1.2 Negative authorization

2.2.1.1.3 Conflict resolution

2.2.1.1.4 Strong and weak authorization

2.2.1.1.5 Propagation of authorization rules

2.2.1.1.6 Special rules

2.2.1.1.7 Consistency and completeness of rules

2.2.1.2 Role-based Access Control

2.2.1.3 Usage Control

2.2.1.4 Attribute-based Access Control

2.2.2 Administration Policies

2.2.3 Identification and Authentication

2.2.4 Auditing a Database System

2.2.5 Views for Security

2.3 Policy Enforcement and Related Issues

2.3.1 SQL Extensions for Security

2.3.2 Query Modification

2.3.3 Discretionary Security and Database Functions

2.4 Data Privacy

2.5 Summary and Directions

References

Chapter 3 Data Mining and Security

3.1 Introduction

3.2 Data Mining Techniques

3.2.1 Overview

3.2.2 Artificial Neural Networks

3.2.3 Support Vector Machines

3.2.4 Markov Model

3.2.4.1 Example

3.2.5 Association Rule Mining (ARM)

3.2.6 Decision Trees

3.2.7 Multi-class Problem

3.2.7.1 One-vs-One

3.2.7.2 One-vs-All

3.3 Data Mining, Cyber Security, and Privacy

3.3.1 Cyber Security Threats

3.3.1.1 Cyber-Terrorism, Insider Threats, and External Attacks

3.3.1.2 Malicious Intrusions

3.3.1.3 Credit Card Fraud and Identity Theft

3.3.1.4 Attacks on Critical Infrastructures

3.3.2 Data Mining for Cyber Security

3.3.3 Security and Privacy-Enhanced Data Mining

3.4 Summary and Directions

References

Chapter 4 Big Data, Cloud, Semantic Web, and Social Network Technologies

4.1 Introduction

4.2 Big Data Management and Analytics Tools and Technologies

4.2.1 Infrastructure Tools to Host Big Data Systems

4.2.1.1 Apache Hadoop

4.2.1.2 MapReduce

4.2.1.3 Apache Spark

4.2.1.4 Apache Pig

4.2.1.5 Apache Storm

4.2.1.6 Apache Flink

4.2.1.7 Apache Kafka

4.2.2 Big Data Management and Analytics Tools

4.2.2.1 Apache Hive

4.2.2.2 Google BigQuery

4.2.2.3 NoSQL Database

4.2.2.4 Google BigTable

4.2.2.5 Apache HBase

4.2.2.6 MongoDB

4.2.2.7 Apache Cassandra

4.2.2.8 Apache CouchDB

4.2.2.9 Oracle NoSQL Database

4.2.2.10 Weka

4.2.2.11 Apache Mahout

4.3 Cloud Computing

4.3.1 Cloud Computing Models

4.3.1.1 Cloud Deployment Models

4.3.1.2 Service Models

4.3.2 Virtualization

4.3.3 Cloud Storage and Data Management

4.3.4 Cloud Platforms

4.3.4.1 Amazon Web Services’ DynamoDB

4.3.4.2 Microsoft Azure’s Cosmos DB

4.3.4.3 IBM’s Cloud-Based Big Data Solutions

4.3.4.4 Google’s Cloud-Based Big Data Solutions

4.4 Semantic Web

4.4.1 Semantic Web Technologies

4.4.1.1 XML

4.4.1.2 RDF

4.4.1.3 SPARQL

4.4.1.4 Owl

4.4.1.5 Description Logics

4.4.1.6 SWRL

4.4.2 Semantic Web and Security

4.4.2.1 XML Security

4.4.2.2 RDF Security

4.4.2.3 Security and Ontologies

4.4.2.4 Secure Query and Rules Processing

4.4.3 Cloud Computing Frameworks Based on Semantic Web Technologies

4.4.3.1 RDF Integration

4.4.3.2 Provenance Integration

4.5 Analyzing and Securing Social Networks

4.5.1 Introduction to Social Networks

4.5.2 Social Media Analytics Applications

4.5.2.1 Applications Extracting Demographics

4.5.2.2 Sentiment Analysis

4.5.2.3 Detecting Communities of Interest

4.5.2.4 Determining Leaders

4.5.2.5 Detecting Persons of Interest

4.5.2.6 Determining Political Affiliation

4.5.3 Data Mining for Social Networks

4.5.3.1 Association Rule Mining

4.5.3.2 Classification

4.5.3.3 Clustering

4.5.3.4 Anomaly Detection

4.5.3.5 Web Mining

4.5.4 Security and Privacy

4.6 Summary and Directions

References

Chapter 5 Big Data Analytics, Security, and Privacy

5.1 Introduction

5.2 Issues in Big Data Security and Privacy

5.2.1 Background for the Workshop

5.2.2 Big Data Management and Analytics

5.2.3 Security and Privacy

5.3 Research Challenges for Big Data Security and Privacy

5.3.1 Workshop Objectives

5.3.2 Philosophy for Big Data Security and Privacy

5.3.3 Examples of Privacy-Enhancing Techniques

5.3.4 Multi-objective Optimization Framework for Data Privacy

5.3.5 Multidisciplinary Approaches

5.3.6 Big Data Analytics for Cyber Security

5.3.7 Cyber Security for Big Data Analytics

5.4 Summary and Directions

References

Conclusion to Part I

PART II Data Science for Cyber Security

Introduction to Part II

Chapter 6 Data Science for Malicious Executables

6.1 Introduction

6.2 Malicious Executables

6.2.1 Architecture

6.2.2 Related Work

6.2.3 Hybrid Feature Retrieval Model

6.3 Design of the Data Mining Tool

6.3.1 Feature Extraction Using n-Gram Analysis

6.3.1.1 A Binary n-Gram Feature

6.3.1.2 Feature Collection

6.3.1.3 Feature Selection

6.3.1.4 Assembly n-Gram Feature

6.3.1.5 DLL Function Call Feature

6.3.2 Details of the Hybrid Feature Retrieval Model

6.3.2.1 Description of the Model

6.3.2.2 The Assembly Feature Retrieval (AFR) Algorithm

6.3.2.3 Feature Vector Computation and Classification

6.4 Evaluation and Results

6.4.1 Experiments

6.4.2 Dataset

6.4.3 Experimental Setup

6.4.4 Results

6.4.4.1 Accuracy

6.4.4.1.1 Dataset1

6.4.4.1.2 Dataset2

6.4.4.1.3 Statistical significance test

6.4.4.1.4 DLL call feature

6.4.4.2 ROC Curves

6.4.4.3 False Positive and False Negative

6.4.4.4 Running Time

6.4.4.5 Training and Testing with Boosted J48

6.4.5 Example Run

6.5 Big Data Analytics

6.6 Summary and Directions

References

Chapter 7 Stream Analytics for Malware Detection

7.1 Introduction

7.2 Stream Mining

7.2.1 Architecture

7.2.2 Related Work

7.2.3 Our Approach

7.2.4 Overview of Novel Class Detection

7.2.5 Classifiers Used

7.3 Details of Novel Class Detection

7.3.1 Definitions

7.3.2 Novel Class Detection

7.3.2.1 Saving the Inventory of Used Spaces during Training

7.3.2.1.1 Clustering

7.3.2.1.2 Storing the cluster summary information

7.3.2.2 Outlier Detection and Filtering

7.3.2.2.1 Filtering

7.3.2.3 Detecting Novel Class

7.3.2.3.1 Computing the set of novel class instances

7.3.2.3.2 Speeding up the computation

7.3.2.3.3 Time complexity

7.3.2.3.4 Impact of evolving class labels on ensemble classification

7.4 Evaluation

7.4.1 Datasets

7.4.1.1 Synthetic Data with Only Concept-Drift (SynC)

7.4.1.2 Synthetic Data with Concept-Drift and Novel-Class (SynCN)

7.4.1.3 Real Data – KDD Cup 99 Network Intrusion Detection

7.4.1.4 Real Data – Forest Cover (UCI Repository)

7.4.2 Experimental Setup

7.4.2.1 Baseline Method

7.4.3 Performance Study

7.4.3.1 Evaluation Approach

7.4.3.2 Results

7.4.3.3 Running Time

7.5 Security Applications and Malware Detection

7.6 Summary and Directions

References

Chapter 8 Cloud-Based Data Science for Malware Detection

8.1 Introduction

8.2 Malware Detection

8.2.1 Malware Detection as a Data Stream Classification Problem

8.2.2 Cloud Computing for Malware Detection

8.2.3 Our Contributions

8.3 Related Work

8.4 Design and Implementation of the System

8.4.1 Ensemble Construction and Updating

8.4.2 Error Reduction Analysis

8.4.3 Empirical Error Reduction and Time Complexity

8.4.4 Hadoop/MapReduce Framework

8.5 Malicious Code Detection

8.5.1 Overview

8.5.2 Non-distributed Feature Extraction and Selection

8.5.3 Distributed Feature Extraction and Selection

8.6 Experiments

8.6.1 Datasets

8.6.1.1 Synthetic Dataset

8.6.1.2 Botnet Dataset

8.6.1.3 Malware Dataset

8.6.2 Baseline Methods

8.6.3 Hadoop Distributed System Setup

8.7 Discussion

8.8 Summary and Directions

References

Chapter 9 Stream Analytics for Insider Threat Detection

9.1 Introduction

9.2 Survey of Insider Threat and Stream Mining

9.2.1 Insider Threat Detection

9.2.2 Stream Mining

9.2.3 Big Data Techniques for Scalability

9.3 Ensemble-Based Insider Threat Detection

9.3.1 Ensemble Learning

9.3.2 Ensemble for Unsupervised Learning

9.3.3 Ensemble for Supervised Learning

9.3.4 Unsupervised Learning

9.3.4.1 Gbad-Mdl

9.3.4.2 Gbad-P

9.3.4.3 Gbad-Mps

9.4 Insider Threat Detection for Sequence Data

9.4.1 Classifying Sequence Data

9.4.1.1 Incremental Learning

9.4.1.2 Ensemble Learning

9.4.1.3 Model Update

9.4.2 Unsupervised Stream-Based Sequence Learning (USSL)

9.4.2.1 Construct the LZW Dictionary by Selecting the Patterns in the Data Stream

9.4.2.2 Constructing the Quantized Dictionary

9.4.3 Anomaly Detection

9.5 Summary and Directions

References

Conclusion to Part II

PART III Security and Privacy-Enhanced Data Science

Introduction to Part III

Chapter 10 Adversarial Support Vector Machine Learning

10.1 Introduction

10.2 Related Work

10.3 Our Approach

10.4 The Problem and the Attacks

10.4.1 Problem Definition

10.4.2 Adversarial Attack Models

10.4.2.1 Free-range Attack

10.4.2.2 Restrained Attack

10.5 Adversarial SVM Learning

10.5.1 AD-SVM against Free-range Attack Model

10.5.2 AD-SVM against Restrained Attack Model

10.6 Experiments

10.6.1 Our Approach

10.6.2 Experiments on Artificial Dataset

10.6.2.1 Data Points Well Separated

10.6.2.2 Data Cluttered Near Separating Boundary

10.6.3 Experiments on Real Datasets

10.6.4 Setting Cf, Cξ, and Cδ

10.7 Summary and Directions

References

Chapter 11 Adversarial Learning Using Relevance Vector Machine Ensembles

11.1 Introduction

11.2 Related Work

11.3 Relevance Vector Machine

11.4 Kernel Parameter Fitting

11.4.1 Our Approach

11.4.2 Kernel Parameter Vector

11.4.3 Attacks Minimizing the Log-Likelihood

11.4.4 Training Issues

11.4.5 Adversarial RVM Learning Algorithm

11.5 Experimental Results

11.5.1 Datasets

11.5.2 Experiments on the Artificial Dataset

11.5.3 Experiments on Real Datasets

11.6 Summary and Directions

References

Chapter 12 Privacy Preserving Decision Trees

12.1 Introduction

12.2 Related Work and Motivation

12.3 Privacy Metrics

12.4 Overview of Decision Tree Construction

12.4.1 Splitting Criterion

12.4.2 Discretizing Continuous Attributes

12.4.3 Stopping Criteria

12.5 Naive Bayes Classifier Construction over Perturbed Data

12.5.1 Naive Bayes Classifier

12.5.2 Over Perturbed Numeric Data

12.6 Privacy Preserving Decision Tree C4.5 (PPDTC4.5)

12.6.1 Motivation

12.6.2 Splitting Criterion Using Threshold

12.6.3 Splitting Training Data by Threshold

12.6.4 Classifying the Original Instance

12.6.5 Splitting Criterion

12.6.6 Splitting Training Data Set Using Random Path Selection

12.6.7 Classifying the Perturbed Instance Using Random Path Selection

12.7 Experimental Results

12.7.1 Our Approach

12.7.2 Local vs. Global Data Mining

12.7.3 Reconstruction-Based Approaches Results

12.7.4 PPDTC4.5 Classifier Accuracy

12.7.5 Algorithm Complexity

12.8 Summary and Directions

References

Chapter 13 Towards a Privacy Aware Quantified Self Data Management Framework

13.1 Introduction

13.2 Privacy-Aware Quantified Self-Data Management Framework

13.2.1 Motivational scenario

13.2.2 Architecture Overview

13.2.3 Related Work

13.2.3.1 Access Control Policies, Privacy, and Usability

13.2.3.2 Personal Data Stores

13.2.3.3 Mining Quantified Self-Data

13.2.3.4 Differential Privacy and Privacy-Preserving Data Mining

13.3 High Level Design of The Framework

13.3.1 Privacy-Aware Data Collection

13.3.2 Privacy-Aware Data Storage and Access

13.3.3 Privacy-Aware Data Analytics and Sharing

13.4 Novel Directions

13.4.1 Security of User Devices

13.5 Behavioral Aspects

13.6 Toward a Formal Framework

13.7 Summary and Directions

References

Chapter 14 Data Science, COVID-19 Pandemic, Privacy, and Civil Liberties

14.1 Introduction

14.2 Data Mining, National Security, Privacy, and Civil Liberties

14.3 Data Science for COVID-19 Detection and Prediction

14.4 Privacy Implications and Potential Solutions

14.5 Revisiting the Multi-objective Framework for Data Privacy

14.6 Role of Confidentiality and Access Control

14.7 What about Civil Liberties?

14.8 Balancing Safety and Security vs. Privacy and Civil Liberties

14.9 Summary and Directions

References

Conclusion to Part III

PART IV Access Control and Data Science

Introduction to Part IV

Chapter 15 Secure Cloud Query Processing Based on Access Control for Big Data Systems

15.1 Introduction

15.2 Our Approach

15.3 Related Work

15.4 Architecture

15.4.1 Data Generation and Storage

15.4.2 File Organization

15.4.3 Predicate Split

15.4.4 Split Using Explicit Type Information of Object

15.4.5 Split Using Implicit Type Information of Object

15.4.6 Access Control Models

15.5 MapReduce Framework

15.5.1 Overview

15.5.2 Input Files Selection

15.5.3 Cost Estimation for Query Processing

15.5.3.1 Ideal Model

15.5.3.1.1 Map input (MI) phase

15.5.3.1.2 Map output (MO) phase

15.5.3.1.3 Reduce input (RI) phase

15.5.3.1.4 Reduce output (RO) phase

15.5.3.2 Heuristic Model

15.5.4 Query Plan Generation

15.5.4.1 Computational Complexity of Bestplan

15.5.4.2 Problem Formulation

15.5.4.3 Search Space Size

15.5.4.4 Relaxed Bestplan Problem and Approximate Solution

15.5.5 Breaking Ties by Summary Statistics

15.5.6 MapReduce Join Execution

15.6 Results

15.6.1 Experimental Setup

15.6.1.1 Datasets

15.6.1.2 Baseline Frameworks

15.6.1.3 Hardware

15.6.1.4 Software

15.6.2 Evaluation

15.7 Security Extensions

15.7.1 Token-Based Access Control Model

15.7.2 Access Token Assignment

15.7.2.1 Final output of an Agent’s ATs

15.7.2.2 Security Level Defaults

15.7.3 Conflicts

15.7.4 XACML-based Access Control

15.8 Summary and Directions

References

Chapter 16 Access Control-Based Assured Information Sharing in the Cloud

16.1 Introduction

16.2 System Design

16.2.1 Design Philosophy

16.2.2 Design of CAISS

16.2.2.1 Enhanced Policy Engine

16.2.2.2 Enhanced SPARQL Query Processor

16.2.2.3 Integration Framework

16.2.3 Limitations of CAISS

16.2.4 Design of CAISS++

16.2.4.1 Centralized CAISS++

16.2.4.2 Decentralized CAISS++

16.2.4.3 Hybrid CAISS++

16.2.4.4 Naming Conventions

16.2.4.5 Vertically Partitioned Layout

16.2.4.6 Hybrid Layout

16.2.4.7 Distributed processing of SPARQL

16.2.4.8 Framework Integration

16.2.4.9 Policy Specification and Enforcement

16.2.5 Extensions to the Design

16.2.5.1 Formal Policy Analysis

16.2.5.2 Extensions for Big Data-based Applications

16.3 Implementation Details

16.3.1 Prototype Implementations

16.3.1.1 Secure Data Storage and Retrieval in the Cloud

16.3.1.2 Secure SPARQL Query Processing on the Cloud

16.3.1.3 Pre-processing

16.3.1.4 Query Execution and Optimization

16.3.1.5 RDF Policy Engine

16.3.1.6 Assured Information Sharing Prototypes

16.3.2 Other Implementations

16.3.3 Implementation of the Demonstration Systems

16.3.3.1 Architecture

16.3.3.1.1 User interface layer

16.3.3.1.2 Policy engines

16.3.3.1.3 Data layer

16.3.3.2 Features of Our Policy Engine Framework

16.3.3.2.1 Policy reciprocity

16.3.3.2.2 Develop and scale policies

16.3.3.2.3 Justification of resources

16.3.3.2.4 Policy specification and enforcement

16.4 Related Work

16.4.1 Research Efforts

16.4.1.1 Secure Data Storage and Retrieval in the Cloud

16.4.1.2 SPARQL Query Processor

16.4.1.3 RDF-based Policy Engine

16.4.1.4 Hadoop Storage Architecture

16.4.1.5 Distributed Reasoning

16.4.1.6 Access Control and Policy Ontology Modeling

16.4.2 Commercial Developments

16.4.2.1 RDF Processing Engines

16.4.2.2 Semantic Web-based Security Policy Engines

16.5 Summary and Directions

References

Chapter 17 Access Control for Social Network Data Management

17.1 Introduction

17.2 Related Work

17.3 Modeling Social Networks Using Semantic Web Technologies

17.3.1 Type of Relationships

17.3.2 Modeling Personal Information

17.3.3 Modeling Personal Relationships

17.3.4 Modeling Resources

17.3.5 Modeling User/Resource Relationships

17.3.6 Modeling Actions

17.4 Security Policies for OSNs

17.4.1 Running Example

17.4.2 Access Control Policies

17.4.3 Filtering Policies

17.4.4 Admin Policies

17.5 Security Policy Specification

17.5.1 Policy Language

17.5.2 Authorizations and Prohibitions

17.5.2.1 Access Control Authorizations

17.5.2.2 Prohibitions

17.5.2.3 Admin Authorizations

17.5.3 Security Rules

17.6 Security Rule Enforcement

17.6.1 Our Approach

17.6.2 Admin Request Evaluation

17.6.3 Access Request Evaluation

17.7 Implementation of an Access Control Framework

17.8 Framework Architecture

17.9 Experiments

17.9.1 Data Generation

17.10 Scalability with Big Data and Cloud Technologies

17.11 Summary and Directions

References

Chapter 18 Inference and Access Control for Big Data

18.1 Introduction

18.2 Design of an Inference Controller

18.2.1 Architecture

18.2.1.1 User Interface Manager

18.2.1.2 Policy Manager

18.2.1.3 Inference Engine

18.2.1.4 Data controller

18.2.1.5 Provenance Controller

18.3 Inference Control Through Query Modification

18.3.1 Query Modification

18.3.2 Query Modification with Relational Data

18.3.2.1 Query Modification

18.3.3 SPARQL Query Modification

18.3.4 Query Modification for Enforcing Constraints

18.3.4.1 SPARQL Query Filter

18.3.4.2 Property Paths

18.3.4.3 Property Path Queries

18.3.4.4 Overview of Query Modification

18.3.4.5 Graph transformation of a SPARQL Query BGP

18.3.4.6 Match Pattern/ApplyPattern

18.3.4.6.1 Processing Rules

18.3.4.6.2 Enforcing Constraints by Graph Rewriting

18.4 Our Approach to the Implementation of the Inference Controller

18.5 Inference and Provenance

18.5.1 Examples

18.5.2 Approaches to the Inference Problem

18.5.2.1 Domain Restriction

18.5.2.2 Statistical Reasoning

18.5.2.2.1 Machine Learning Techniques

18.5.3 Inferences in Provenance

18.5.3.1 Implicit Information in Provenance

18.5.4 Use Cases of Provenance

18.5.4.1 Dataset Documentation

18.5.4.2 Pinpoint Errors in a Process

18.5.4.3 Identifying Private Information in Query Logs

18.5.4.4 Use Case: Who Said That?

18.5.4.5 Use Case: Cheating Dictator

18.5.5 Processing Rules

18.6 Implementation Details

18.6.1 Architecture

18.6.2 Provenance in a Healthcare Domain

18.6.2.1 Populating the Provenance Knowledge Base

18.6.2.2 Generating and Populating the Knowledge Base

18.6.2.3 Generating Workflows

18.6.2.4 Properties of the Workflow

18.6.3 Policy Management

18.6.3.1 Policy Screen

18.6.3.2 Parsing Process

18.6.3.3 High-Level Policy Translation

18.6.3.4 SWRL Rule Assembler

18.6.3.5 A SWRL Policy Translation

18.6.3.6 Description Logics Rule Assembler

18.6.3.7 Cardinality Restrictions

18.6.3.8 hasValue Restriction

18.6.3.9 Supporting Restrictions

18.6.3.9.1 A DL policy translation

18.6.3.10 Access Control Policy Assembler

18.6.3.11 An Access Control Policy Translation

18.6.3.12 Redaction Policy Assembler

18.6.3.13 A Redaction Policy Translation

18.6.4 Explanation Service Layer

18.7 Generators

18.7.1 Selecting background information

18.7.2 Background generator module

18.7.2.1 Patient Generator

18.7.2.2 Physician Generator

18.7.2.3 Hospital Generator

18.7.3 Miscellaneous generators

18.7.4 Workflow generator

18.7.5 Annotating the Workflow

18.7.6 Generating workflows

18.7.7 Incomplete information in the databases

18.8 Use Case: Medical Example

18.8.1 Semantic associations in the workflow

18.9 Implementing Constraints

18.9.1 Query modification for enforcing constraints

18.9.1.1 Query Filter

18.10 Next Generation Inference Controllers

18.11 Summary and Directions

References

Chapter 19 Emerging Applications for Secure Data Science: Internet of Transportation Systems

19.1 Introduction

19.2 Integration of Cyber Security and AI

19.3 Security and Privacy for the Internet of Transportation Systems

19.4 AI and Security for Cloud-based Internet of Transportation Systems

19.5 Summary and Directions

References

Conclusion to Part IV

Chapter 20 Summary and Directions

20.1 About This Chapter

20.2 Summary of this Book

20.3 Directions for Secure Data Science

20.4 Where Do We Go From Here?

Appendix: Data Management Systems – Developments and Trends

A.1 Introduction

A.2 Developments in Database Systems

A.3 Status, Vision, and Issues

A.4 Data Management Systems Framework

A.5 Building Information Systems from the Framework

A.6 Relationship Between the Texts

A.7 Summary and Directions

References

Index